﻿
using System;
using System.Drawing;
using System.Collections;
using System.ComponentModel;
using System.Windows.Forms;
using System.Data;
using System.IO;

namespace RecursiveSearchCS
{
    /// <summary>
    /// Summary description for Form1
    /// </summary>
     public partial class Form1 : System.Windows.Forms.Form
    {
        internal System.Windows.Forms.Button btnSearch;
        internal System.Windows.Forms.TextBox txtFile;
        internal System.Windows.Forms.Label lblFile;
        internal System.Windows.Forms.Label lblDirectory;
        internal System.Windows.Forms.ListBox lstFilesFound;
        internal System.Windows.Forms.ComboBox cboDirectory;

        public Form1()
        {
            // 
            // Required for Windows Form Designer support
            // 
            InitializeComponent();

            // 
            // TODO: Add any constructor code after InitializeComponent call.
            // 
            //checkBox1.Checked = true;
            checkBox1.Checked = false; // this sets the search/delete button text
            MessageBox.Show("COPYRIGHT (C) 2016 - ANDERSON DIGITAL Pty Ltd provides this open source program under a Creative Commons license. Warning: Anyone can compile this utility from the open source code and alter it for malicious purposes. By using it you are agreeing to its use ENTIRELY at your own risk.\r\n\r\nThis utility is intended only to FREE UP DRIVE SPACE as part of an effective recovery strategy from a extortionist 'Ransomware' style file encryption attack that renames your files to (typically) an MP3 file type. This addresses ransomware attempts to make normal bulk file deletion of encrypted files impractical and otherwise rendering the entire drive unsalvageable. This utility CANNOT safely identify and remove an encrypted file without the original file (name) existing in the same folder. It is designed NOT to delete any encrypted files that you have NOT yet recovered from your backups.\r\n\r\nFirst you MUST remove the ransomware from the infected computer and/or drive. Next, inspect/verify/test this program on a network isolated test computer to ensure you can trust it and fully understand what it does. Next recover your original files from backups into the ORIGINAL folders. Then and ONLY then, run this program (as often as needed) to remove the encrypted (*.MP3) files. This program effectively terminates any opportunity to recover the encrypted files from the extortionists or anyone else. NOTE: The program simply tests if the original recovered file NAME exists (ie minus the '.MP3') and no other validation is done or possible. \n\r\n\rIt is intended to ONLY permanently delete all the encrypted (*.MP3) files, and ONLY where an original and encrypted filename pair exists in the SAME folder, and to leave the corresponding recovered original files (having the original filename) and ALL other files COMPLETELY unaltered and untouched.\n\r\n\rAs this is a malware recovery program, beware of imitations or mimics that alter recovered files or do more than simply delete the encrypted ones. Only download this software from a trusted source.", "ABOUT Ransomware Cleanup Utility", MessageBoxButtons.OK);
        }

        private Boolean chkValid()
        {
            if ((txtFile.TextLength != 5) || (txtFile.Text.Substring(0, 2) != "*."))
            {
                errMsg.Text = "Search string must be 5 characters staring with '*.' ";
                return false;
            }

            errMsg.Text = "";
            return true;
        }

        private void btnSearch_Click(object sender, System.EventArgs e)
        {
            if (!chkValid()) return;

            lstFilesFound.Items.Clear();
            txtFile.Enabled = false;
            cboDirectory.Enabled = false;
            errMsg.Text = "Searching...";
            this.Cursor = Cursors.WaitCursor;
            Application.DoEvents();
            DirSearch(cboDirectory.Text);
            errMsg.Text = "Finished Search";
            checkBox1.Checked = false;
            this.Cursor = Cursors.Default;
            txtFile.Enabled = true;
            cboDirectory.Enabled = true;
        }

        private void Form1_Load(object sender, System.EventArgs e)
        {
            cboDirectory.Items.Clear();
            foreach (string s in Directory.GetLogicalDrives())
            {
                cboDirectory.Items.Add(s);
            }
        }

        void DirSearch(string sDir)
        {
            string g;
            errMsg.Text = "";

            try
            {
                foreach (string d in Directory.GetDirectories(sDir))
                {
                    foreach (string f in Directory.GetFiles(d, txtFile.Text))
                    {
                        lstFilesFound.Items.Add(f);
                        g = f.Remove(f.Length - 4);
                        if (File.Exists(g))
                        {
                            lstFilesFound.Items.Add(g);
                            if (checkBox1.Checked) File.Delete(f);
                        }
                    }
                    DirSearch(d);
                }
            }
            catch (System.Exception excpt)
            {
                errMsg.Text = excpt.Message;
            }
        }

        private void checkBox1_CheckedChanged(object sender, EventArgs e)
        {
            errMsg.Text = "";
            btnSearch.Text = checkBox1.Checked ? "DELETE encrypted files having originals" : "SEARCH original && encrypted files";
            if(checkBox1.Checked)
            {
                if (MessageBox.Show("This will permanently delete all the encrypted files ONLY where an original and encrypted filename pair exists. This will free up drive space after you have recovered the original file from backups.\r\n\r\nThere is no Recycle Bin recovery.\r\n\r\nThe corresponding recovered original files (having the original filename) will NOT be deleted.\r\n\r\nARE YOU SURE ?", "WARNING", MessageBoxButtons.YesNo, MessageBoxIcon.Question) == DialogResult.No) checkBox1.Checked=false;
            }
        }

        private void label1_Click(object sender, EventArgs e)
        {

        }

        private void lblDirectory_Click(object sender, EventArgs e)
        {

        }

        private void button1_Click(object sender, EventArgs e)
        {
            errMsg.Text = "";
            folderBrowserDialog1.ShowNewFolderButton = false;
            if (folderBrowserDialog1.ShowDialog() != System.Windows.Forms.DialogResult.Cancel)
            {
                cboDirectory.Text = folderBrowserDialog1.SelectedPath;
                cboDirectory.Items.Add(cboDirectory.Text);
            }
        }

        private void txtFile_TextChanged(object sender, EventArgs e)
        {
            errMsg.Text = "";
            chkValid();

        }

        private void cboDirectory_SelectedIndexChanged(object sender, EventArgs e)
        {
            errMsg.Text = "";

        }
    }
}